Guidance Statement GS 016 Bank Confirmation Requests

Transcription

1 GS 016 (June 2010) Guidance Statement GS 016 Bank Confirmation Requests Issued by the Auditing and Assurance Standards Board

2 Obtaining a Copy of this Guidance Statement This Guidance Statement is available on the Auditing and Assurance Standards Board (AUASB) website: Contact Details Auditing and Assurance Standards Board Level Bourke Street Melbourne Victoria 3000 AUSTRALIA Phone: (03) Fax: (03) enquiries@auasb.gov.au Postal Address: PO Box 204 Collins Street West Melbourne Victoria 8007 AUSTRALIA COPYRIGHT 2010 Auditing and Assurance Standards Board (AUASB). The text, graphics and layout of this Guidance Statement are protected by Australian copyright law and the comparable law of other countries. Reproduction within Australia in unaltered form (retaining this notice) is permitted for personal and non-commercial use subject to the inclusion of an acknowledgment of the source. Requests and enquiries concerning reproduction and rights for commercial purposes within Australia should be addressed to the Executive Director, Auditing and Assurance Standards Board, PO Box 204, Collins Street West, Melbourne Victoria Otherwise, no part of the Guidance Statement may be reproduced, stored or transmitted in any form or by any means without the prior written permission of the AUASB except as permitted by law. ISSN GS GUIDANCE STATEMENT

3 CONTENTS AUTHORITY STATEMENT Paragraphs Application Issuance Date... 3 Introduction Definitions... 6 Bank Confirmations The Audit Process and Bank Confirmations Deciding Whether to Request a Bank Confirmation Nature of the Evidence Obtained from a Bank Confirmation Remaining Alert to the Possibility of Fraud Bank Confirmation Procedures Determining the Bank Information to be Confirmed and Selecting the Appropriate Confirming Party (Parties) Designing the Bank Confirmation Request Pre-completing the Standard Bank Confirmation Request Form Submitting the Bank Confirmation Request Authority to Disclose Guarantees and Other Third Party Securities Timing of Bank Confirmation Requests Acknowledgement of Receipt by the Bank Following-Up Bank Confirmation Requests Results of the Bank Confirmation Process Electronic Bank Confirmation Processes Disclaimers or Restrictive Language Co-operation with the Banking Industry Conformity with International Pronouncements GS GUIDANCE STATEMENT

4 Appendix 1: Bank Confirmation Audit Request (General) Appendix 2: Bank Confirmation Audit Request (Treasury and Other Operations) Appendix 3: Example Letter: Customer Request and Authority to Disclose Appendix 4: Example Form: Request for Acknowledgement of Receipt of Bank Confirmation Request GS GUIDANCE STATEMENT

5 AUTHORITY STATEMENT The Auditing and Assurance Standards Board (AUASB) formulates Guidance Statement GS 016 Bank Confirmation Requests pursuant to section 227B of the Australian Securities and Investments Commission Act 2001, for the purposes of providing guidance on auditing and assurance matters. This Guidance Statement provides guidance to assist the auditor to fulfil the objectives of the audit or assurance engagement. It includes explanatory material on specific matters for the purposes of understanding and complying with AUASB Standards. The auditor exercises professional judgement when using this Guidance Statement. The Guidance Statement does not prescribe or create new mandatory requirements. Dated: 10 June 2010 M H Kelsall Chairman - AUASB GS GUIDANCE STATEMENT

6 Application GUIDANCE STATEMENT GS 016 Bank Confirmation Requests 1 This Guidance Statement has been formulated by the Auditing and Assurance Standards Board (AUASB) to provide guidance to auditors on the enquiry and confirmation methods for obtaining audit evidence regarding an entity s bank accounts and transactions, in accordance with the Australian Auditing Standards. 1 2 This Guidance Statement is applicable to audit engagements with financial reporting periods ending on or after 30 September Issuance Date 3 This Guidance Statement is issued on 10 June 2010 by the AUASB. Introduction 4 This Guidance Statement has been developed by the AUASB in consultation with the Australian Bankers Association (ABA), and with the co-operation of its members. 2 5 While this Guidance Statement deals specifically with communications with banks that are members of the ABA, the guidance may be applied to confirmation requests directed to other authorised deposit-taking institutions, for example, building societies and credit unions. Definitions 6 For the purposes of this Guidance Statement, the following terms have the meanings attributed below: (a) Bank means banks and other authorised deposit-taking institutions. 1 2 For the purposes of this Guidance Statement, Australian Auditing Standards are those standards issued by the AUASB in October 2009 that apply to audits and reviews of financial reports for reporting periods commencing on or after 1 January See for a list of the banks that are members of the ABA. GS GUIDANCE STATEMENT

7 (b) External confirmation means audit evidence obtained by the auditor as a direct written response to the auditor from a third party (the confirming party), in paper form, or by electronic or other medium. 3 (c) Bank Confirmations Bank confirmation is a particular type of external confirmation used by an auditor to obtain independent confirmation from a bank or other authorised deposit-taking institution for audit purposes of information such as an entity s bank account balances, securities, treasury management instruments, documents and other related information held by the bank, or authorised deposit-taking institution, on behalf of the entity. 7 Information obtained from a bank confirmation assists the auditor in discharging the auditor s responsibility to obtain reasonable assurance about whether the financial report as a whole is free from material misstatement, thereby enabling the auditor to express an opinion on the financial report. 4 8 Under Australian Auditing Standards, the auditor is required to obtain sufficient appropriate audit evidence to reduce risk to an acceptably low level, thereby enabling the auditor to draw reasonable conclusions on which to base the auditor s opinion. 5 Information obtained from a bank confirmation may assist the auditor in obtaining sufficient appropriate audit evidence regarding bank-related transactions and account balances, and their presentation and disclosure in the financial report. The Audit Process and Bank Confirmations 9 ASA 300 Planning an Audit of a Financial Report requires the auditor to plan the audit through establishing an overall audit strategy and developing an audit plan, so that the engagement will be performed in an effective manner. The audit plan is more detailed than the overall audit strategy in that it includes the nature, timing and extent of audit procedures to be performed by engagement team members See ASA 505 External Confirmations, paragraph 6(a). See ASA 200 Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with Australian Auditing Standards, paragraph 11. See ASA 200, paragraph 17. GS GUIDANCE STATEMENT

8 10 ASA 315 Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and Its Environment requires the auditor to identify and assess the risks of material misstatement, whether due to fraud or error, at the financial report and assertion levels. 11 Risks of material misstatement: (a) (b) at the financial report level may derive from a deficient control environment (or relate to other factors, such as declining economic conditions); 6 and at the assertion level 7 may relate to assertions made, implicitly or explicitly, by management or where appropriate those charged with governance regarding the recognition, measurement, presentation and disclosure of bank-related elements of the financial report and related disclosures. This may include assertions regarding: (i) bank-related classes of transactions and events for the period under audit, including: occurrence; completeness; accuracy; cut-off; and classification; and (ii) account balances at the period end, including: existence; rights and obligations; completeness; and valuation; and 6 7 See ASA 315, paragraphs A105-A107. See ASA 315, paragraphs A109-A112. GS GUIDANCE STATEMENT

9 (iii) presentation and disclosure, including: occurrence and rights and obligations; completeness; classification and understandability; and accuracy and valuation. Deciding Whether to Request a Bank Confirmation 12 ASA 330 The Auditor s Responses to Assessed Risks requires the auditor to design and implement responses to the assessed risks of material misstatement in the financial report. For each material class of transactions, account balance, and disclosure, irrespective of the assessed risks of material misstatement, the auditor is required to design and perform substantive procedures. 8 In particular, in respect of bank-related transactions, account balances and disclosures, the auditor shall consider whether external confirmation procedures are to be performed When the entity s banking activities, including treasury operations, are significant, complex, or unusual, or there are deficiencies in the entity s control environment that may impact the assertions and disclosures regarding the entity s banking activities, the auditor would ordinarily send a bank confirmation request(s). 14 In other instances, when: (a) (b) (c) an entity s banking activities are simple and straightforward; and the auditor has considered the entity s control environment and assessed the risk of material misstatement of bankrelated account balances and disclosures as low; and there are other means to obtain sufficient appropriate audit evidence in respect of banking activities; the auditor may decide not to request a bank confirmation. 8 9 See ASA 330, paragraph 18. See ASA 330, paragraphs 19 and A48-A51. GS GUIDANCE STATEMENT

10 15 Alternative sources of audit evidence may include, for example, bank statements for the relevant period provided on bank letterhead; together with: (a) the bank facilities letter, on bank letterhead, documenting the banking facilities used by, or made available to, the entity; and (b) bank reconciliations that agree to the bank statements. Nature of the Evidence Obtained from a Bank Confirmation 16 ASA 500 Audit Evidence requires the auditor to design and perform audit procedures that are appropriate in the circumstances to obtain sufficient appropriate audit evidence 10 and discusses the relevance and reliability of audit evidence in an audit of a financial report Relevance deals with the logical connections with, or bearing upon, the purpose of the audit procedure and, where appropriate, the assertion under consideration. A given set of audit procedures may provide audit evidence that is relevant to certain assertions, but not others. Thus, for example, for certain investments a bank confirmation may provide information that addresses the existence assertion, but not the valuation assertion. In such circumstances, it may be necessary to consider performing alternative or additional audit procedures to address the valuation assertion. 18 The reliability of audit evidence is influenced by its source and by its nature and is dependent on the individual circumstances under which it is obtained. The reliability of the evidence obtained from information contained in a response to a bank confirmation request, is influenced by the circumstances in which the request is made and the response is received. 19 ASA 500 states that audit evidence is generally more reliable when it is obtained from independent sources outside the entity. 12 However, even when audit evidence, such as a bank confirmation, is obtained from sources external to the entity, circumstances may exist that could affect the reliability of the information obtained. For example, all confirmation responses carry some risk of interception, alteration or fraud. Such risk exists regardless of whether a response is obtained in paper form, or through electronic or other medium See ASA 500, paragraph 6. See ASA 500, paragraphs 7 and A26-A33. See ASA 500, paragraph A31 and ASA 505, paragraph 2. GS GUIDANCE STATEMENT

11 20 ASA 500 further states that audit evidence obtained by original documents is generally more reliable than audit evidence provided by photocopies or facsimiles, or documents that have been filmed, digitised or otherwise transformed into electronic form. Where an auditor chooses to send or receive bank confirmations electronically, it is important to consider the controls built into this process to determine the reliability of the information obtained. (See Electronic Bank Confirmation Processes below) 21 The auditor is required to exercise professional scepticism in accordance with ASA ASA 200 explains that an attitude of professional scepticism means the auditor makes a critical assessment, with a questioning mind, of the validity of audit evidence obtained and is alert to audit evidence that contradicts or brings into question the reliability of documents and responses to enquiries. 14 However, unless the auditor has reason to believe the contrary, the auditor may accept records and documents as genuine. 15 If there is any indication that a confirmation response may not be reliable, ASA 505 External Confirmations emphasises the need for the auditor to consider the response s reliability and to perform audit procedures to dispel any concern (for example, the auditor may choose to verify the source and contents of the response in a telephone call to the purported sender). 16 Remaining Alert to the Possibility of Fraud 22 While the primary responsibility for the prevention and detection of fraud rests with both those charged with governance of the entity and management, 17 the auditor, in exercising professional scepticism, remains alert to the possibility of fraud in the bank confirmation process. 23 When determining whether to use bank confirmation requests, it may be important to be alert to the entity s circumstances and its environment, the circumstances surrounding the confirmation process, and the information obtained from the confirmation process that may indicate a risk of material misstatement. 24 Being alert to the possibility of fraud may be particularly important when an external confirmation is the primary audit evidence for a See ASA 200, paragraph 15. See ASA 200, paragraphs A18-A22. See ASA 200, paragraph A21. See ASA 505, paragraph 10. See ASA 240 The Auditor s Responsibilities Relating to Fraud in an Audit of a Financial Report, paragraph 4. GS GUIDANCE STATEMENT

12 material financial report item, particularly if the item itself is susceptible to fraud. This risk may arise, for example, when requesting confirmation of the existence of liquid funds and investments held by the entity in an offshore bank. 25 Heightened professional scepticism may also be called for when dealing with unusual or unexpected responses to confirmation requests, such as a significant change in the number or timeliness of responses to bank confirmation requests relative to prior audits, or a non-response when a response would be expected. Bank Confirmation Procedures 26 ASA 505 emphasises the importance of the auditor maintaining control over the external confirmation process to enhance the reliability of the audit evidence obtained through the process. 27 When using bank confirmations, the auditor maintains control over the process through: 18 (a) (b) (c) determining the bank information to be requested; selecting the appropriate confirming party(parties); designing the bank confirmation request, ensuring that it: (i) (ii) (iii) is properly addressed; is clear, accurate and sufficiently detailed; and contains an accurate return address, for responses to be sent directly to the auditor. (d) (e) considering the timing of the lodgement of the request and the date by which a response is required; and taking follow-up action when a response is overdue. Determining the Bank Information to be Confirmed and Selecting the Appropriate Confirming Party (Parties) 28 The auditor may determine the bank information to be confirmed and select the appropriate confirming party (parties) through: 18 See ASA 505, paragraph 7. GS GUIDANCE STATEMENT

13 (a) (b) (c) (d) (e) (f) (g) discussions with management or where appropriate those charged with governance; analysing the assertions made by the entity in the financial report being audited; checking the annual banking facilities letter, if any; inspecting bank statements; inspecting the minutes of meetings of the Board, audit committee, finance committee, management team or other internal committee; evaluating the work of internal audit; or knowledge of the entity s banking relationships from prior periods. 29 The information to be confirmed may relate to: (a) normal banking activities, such as: (i) (ii) (iii) (iv) (v) account balances at the period end for current accounts, interest bearing deposit accounts, foreign currency accounts, money market deposits, overdraft accounts, bank loans and term loans; interest rates and terms of other liabilities to the bank, such as bills of exchange, forward exchange contracts, letters of credit, guarantees and indemnities undertaken by the bank; items held as security for the entity s liabilities to the bank; accounts opened or closed by the entity during the period; and unused limits and facilities; and/or (b) treasury operations, such as: (i) (ii) forward rate agreements; foreign currency contracts; GS GUIDANCE STATEMENT

14 (iii) (iv) (v) interest rate swaps; options; and treasury futures contracts; and (c) other contractual arrangements. Designing the Bank Confirmation Request 30 Standard bank confirmation request forms provide for the confirmation or provision of information which is customarily held by banks. Accordingly, two standard bank confirmation request forms have been developed through consultation with auditors and the ABA. The two forms are: (a) (b) Bank Confirmation Audit Request (General) (Appendix 1) the information to be confirmed or requested relates to normal banking activities and is substantially the same for a range of entities; and Bank Confirmation Audit Request (Treasury and Other Operations) (Appendix 2) the information to be confirmed or requested relates to the entity s treasury operations and use of treasury management instruments. These forms are also available as separate documents on the AUASB website 19, to facilitate their use in the confirmation process, if required. 31 While the standard bank confirmation request forms will generally provide the information required by the auditor in a range of audit engagements, there may be instances where the standard forms are not appropriate. For example, the auditor may require confirmation of matters not covered by the standard bank confirmation request forms and may write a separate letter requesting confirmation of specific matters. 32 Where a letter is used by the auditor to request bank confirmation, the letter would clearly identify the details of the information for which confirmation is required and would carry the entity s authorisation for the bank to provide the confirmation to the auditor. 19 See GS GUIDANCE STATEMENT

15 33 To avoid unnecessary delays in the confirmation process, the auditor ensures that a bank confirmation request is properly addressed. It is not sufficient, for example, to address a request to The Manager, ABC Bank. Similarly, a request needs to contain sufficient, accurate information to enable the request to be clearly understood. For example, where the auditor is seeking bank information relating to a parent entity and its subsidiaries, that should be made clear in the bank confirmation request. A valid return address, direct to the auditor, is also important to minimise delays in the process. Pre-completing the Standard Bank Confirmation Request Form 34 Where the auditor uses the standard bank confirmation request forms provided in this Guidance Statement, the auditor, in consultation with the entity, is responsible for pre-completing all known details in the shaded areas of the forms prior to forwarding the forms to the bank. It is important to complete known account names and the corresponding BSB and account numbers, as this will assist the bank in locating the relevant information. 35 The bank is responsible for checking the information supplied by the auditor and completing the information requested in the unshaded areas of the forms. Submitting the Bank Confirmation Request 36 Having decided to obtain a bank confirmation, and selected and completed the appropriate bank confirmation request form, the auditor plans the submission of the request to the bank. 37 The auditor determines where to submit the bank confirmation request. In some instances, banks process bank confirmation requests at the branch level; therefore the auditor should address the bank confirmation request to the relevant branch. In other instances, banks have a single, centralised point of contact for the lodgement of all bank confirmation requests. Some banks may have different addresses for the lodgement of requests depending on the customer type. For example, the address for general requests may be different to the address for requests regarding treasury and other operations. 38 It is the auditor s responsibility to determine the appropriate address for the bank confirmation request. To assist the auditor, the ABA GS GUIDANCE STATEMENT

16 has agreed to publish on its website 20 the addresses of its members for the lodgement of bank confirmation requests. Authority to Disclose 39 Banks require the explicit authority of the entity to disclose information to the auditor in response to a bank confirmation request. For this reason, the auditor would ordinarily request the entity to complete and sign a letter of authorisation to be forwarded to the bank together with the bank confirmation request. An example authorisation letter is provided in Appendix 3 of this Guidance Statement. 40 When a third party is involved, the auditor, with the assistance of the entity, may seek authorisation from the third party allowing disclosure or confirmation of relevant information by the bank. (See Guarantees and Other Third Party Securities below.) 41 One authorisation letter may be used to cover several bank confirmation requests, for example, requests relating to a parent and its subsidiaries, provided all entities and the relevant authorising officers are listed in the authorisation letter. 42 It is the auditor s responsibility to confirm with the entity that the names and titles of the authorising officers provided in the authorisation letter are up to date. Incorrect or invalid information regarding authorising officers may result in delays in the bank s response to a bank confirmation request. Guarantees and Other Third Party Securities 43 The provision of information about guarantees and other third party securities has, on occasion, resulted in significant delays in the completion of bank confirmation requests because the bank does not have sufficient authority to provide full disclosure of the information requested, due to data protection regulations concerning the counter-parties. When the bank does not have sufficient authority to provide full disclosure, the bank advises the auditor that further authority is required to provide full disclosure of such guarantees or third party securities. The auditor can then obtain details of the arrangements from the entity, for example, by requesting a copy of the relevant facility letter, loan agreement or contract. In some cases, these procedures may provide sufficient appropriate audit evidence. In other cases, the auditor may require further 20 See GS GUIDANCE STATEMENT

17 independent evidence and may seek further authority from the guarantor or third party for the bank to provide information to the auditor. Timing of Bank Confirmation Requests 44 Where practicable, the auditor sends the bank confirmation request to the bank at least 15 working days in advance of the period end date. It is advisable to allow more time for requests covering the June and December period ends, as the banks receive large numbers of bank confirmation requests at this time. 45 Late lodgement of bank confirmation requests may result in delays in the bank s response. Acknowledgement of Receipt by the Bank 46 The ABA has agreed to publish on its website a list of its members and whether or not they acknowledge receipt of audit requests for bank confirmations. 47 If acknowledgement is required, the auditor should include a Request for Acknowledgement of Receipt with the request for a bank confirmation. An example Request for Acknowledgement of Receipt letter is provided in Appendix 4 of this Guidance Statement. 48 Those banks that provide acknowledgements of receipt of audit requests if asked, will endeavour to do so within 5 working days of receipt. As part of the acknowledgement process, banks may indicate either a date by which they expect to respond to the auditor regarding the bank confirmation request, or provide an indication of the time allowed in their standard service level agreement for this process. Following-Up Bank Confirmation Requests 49 The auditor should allow an appropriate time for the bank to process a bank confirmation request before following-up for a response. 50 The bank may have a service level agreement with an entity or a standard service level agreement applicable to all entities regarding response times for bank confirmation requests. In general, the ABA has agreed that its members will endeavour, once a request is received and the confirmation date has passed, to process bank confirmation requests within the following timeframes: GS GUIDANCE STATEMENT

18 (a) Simple requests (for example, account balances only) within 5-10 working days; and (b) Complex requests (for example, multiple facilities, guarantees, third party securities, group comprising a parent entity and subsidiaries) within working days. 51 The auditor should not follow-up before the expected response time has passed, as these types of pre-production enquiries lead to significant delays and unnecessary costs in the bank confirmation process. 52 Where the bank confirmation request is not received by the bank on a timely basis, or contains incomplete, unclear or incorrect information, or the bank does not have the necessary authority to disclose information, a response may take longer than the times indicated above. 53 Where the customer has banking arrangements across a number of jurisdictions or a bank maintains its records for certain bank transactions or accounts in different jurisdictions, a response may take longer than the times indicated above. 54 The ABA has agreed to publish on its website bank contact details for follow-up of audit requests for bank confirmation requests. It is important that auditors use these contact details, where provided, as telephone calls and electronic mail to other areas of the bank lead to unnecessary work and cost for the banks involved. The auditor should note that banks may have different addresses for the follow up of general requests compared to requests regarding treasury and other operations. Results of the Bank Confirmation Process 55 The auditor evaluates the bank s response to a bank confirmation request and determines whether the response provides relevant and reliable audit evidence about the entity s bank accounts and transactions, or whether further audit evidence is required The auditor may need to carry out additional audit procedures. For example, it is generally unwarranted for the auditor to place sole reliance on the information obtained through a bank confirmation request to satisfy the completeness assertion. This may be due to various factors such as: 21 See ASA 505, paragraphs and 16. GS GUIDANCE STATEMENT

19 (a) (b) (c) (d) (e) other audit procedures indicate doubt as to the completeness of the information provided by the bank; a question on the bank confirmation request remains unanswered by the bank; the auditor believes there is a risk that material accounts, agreements or transactions exist, that have not been disclosed in the bank confirmation; the bank s disclaimer regarding the information provided (see paragraphs of this Guidance Statement); or limitations arising from the bank s ability to gather all information in respect of an entity s banking activities (see paragraph 74 of this Guidance Statement). 57 The auditor therefore considers performing additional audit procedures to obtain evidence over the completeness of information about bank accounts and transactions. The appropriateness of performing such procedures is dependent on the entity s circumstances and the assessed level of risk, and may include: (a) (b) (c) (d) (e) (f) requesting separate confirmation of the completeness of the information directly from the entity s relationship manager at the bank; contacting the bank separately about specific issues of concern; performing additional journal entry test work around cash and disbursements and reviewing cash transactions for unusual flows of funds; asking the entity to include a paragraph in the management representation letter confirming that the bank information is complete; reviewing minutes of meetings where new bank accounts or arrangements may have been agreed; or enquiring of the entity s treasury department, or other appropriate personnel in the entity, whether they are aware of any additional banking arrangements. GS GUIDANCE STATEMENT

20 58 On its own, an oral response to a bank confirmation request does not meet the definition of an external confirmation because it is not a direct written response to the auditor. However, upon obtaining an oral response to a bank confirmation request, the auditor may, depending on the circumstances, request the bank to respond in writing directly to the auditor. If no such response is received, in accordance with ASA 505, 22 the auditor seeks other audit evidence to support the information in the oral response. Electronic Bank Confirmation Processes 59 Largely in an effort to make the external confirmation process more efficient and effective, auditors and banks have been increasingly relying on new technologies to facilitate the bank confirmation process. Electronic mail, facsimiles, and other electronic communications have become accepted methods of communication in addition to traditional mail. In some jurisdictions, certain confirmation processes also now involve the use of third party service providers serving as intermediaries between the auditor and the bank through an electronic medium. For example, some banks and authorised deposit-taking institutions will no longer accept and respond to paper confirmation requests received by mail and will only respond to confirmation requests sent electronically through designated third party service providers. Confirmations obtained through these various technological means may broadly be described as electronic confirmations. 60 ASA 505 does not preclude the use of an electronic confirmation process or the acceptance of electronic confirmations as audit evidence. While electronic confirmations may improve response times and claim to increase the reliability of responses, they may also give rise to new risks that the responses might not be reliable. For example, with electronic responses, proof of origin and authority of the respondents to respond may be difficult to establish, and alterations may be difficult to detect. 61 An electronic bank confirmation process used by the auditor and the bank that creates a secure environment for executing the confirmation request and receiving the response may mitigate the risk of inappropriate human intervention and manipulation. An important factor may therefore be the mechanism that is established between the auditor and the bank to minimise the risk that the electronic bank confirmation will be compromised because of interception, alteration, or fraud. 22 See ASA 505, paragraph 12. GS GUIDANCE STATEMENT

21 62 The auditor may need to design and perform tests of controls 23 to obtain sufficient appropriate audit evidence as to the operating effectiveness of controls over the electronic confirmation process before relying on the information obtained. If the auditor is satisfied that such a process is secure and properly controlled, the reliability of the related responses is enhanced. 63 If the auditor has doubts about the reliability of an electronic bank confirmation arising from the risks that: (a) (b) (c) the response may not be from the proper source; a respondent may not be authorised to respond; and the integrity of the transmission may have been compromised, it may be possible to verify the source and contents of the response by contacting the bank. 64 For example, when a confirmation response is transmitted by electronic mail or facsimile, it may be appropriate to telephone the bank to determine whether the bank did, in fact, send the response. It may also be possible to ask the bank to mail the original confirmation directly to the auditor. If a response is received indirectly (for example, because the bank incorrectly addressed it to the entity rather than to the auditor), it may be appropriate to ask the bank to respond again in writing directly to the auditor. 65 If a bank will only respond to a confirmation request through a third party service provider and the auditor plans to rely on the service provider s process, it may be important that the auditor be satisfied with the controls over the information sent by the entity to the service provider to initiate the process, and the controls applied during processing of the data and preparation and sending of the confirmation response to the auditor. A service auditor s report on the service provider s process may assist the auditor in evaluating the design and operating effectiveness of the electronic and manual controls with respect to that process. In the absence of a service auditor s report on the service provider, it may be important that the auditor designs other procedures to evaluate the design and operating effectiveness of the electronic and manual controls with 23 See ASA 330, paragraphs 8-11 regarding the requirements for the auditor to design and perform tests of controls. GS GUIDANCE STATEMENT

22 respect to that process, and/or check the accuracy and completeness of the electronic confirmations received. 66 An electronic confirmation process might incorporate various techniques for validating the identity of the sender of electronic information and that person s authority to confirm the requested information, for example, the use of data encryption, 24 electronic digital signatures 25 and procedures to verify web site authenticity. 26 Disclaimers or Restrictive Language 67 The auditor considers the nature of any disclaimer or restrictive language used in a response to a bank confirmation request 27 to determine whether or not the disclaimer or restrictive language affects the reliability of the response as audit evidence. In general, the auditor can reasonably rely upon information given by the bank provided it corroborates the assertions made by management and is not clearly wrong, suspicious, inconsistent in itself, ambiguous, or in conflict with other evidence gathered during the course of the audit, even where the response includes a standard disclaimer of liability. 68 However, certain restrictive language may cast doubt on the completeness or accuracy of the information contained in the response, or the auditor s ability to rely on that information. Examples of such restrictive language include statements such as: (a) (b) Information is obtained from electronic data sources, which may not contain all information in the bank s possession. Information is not guaranteed to be accurate nor current and may be a matter of opinion Encryption is the process of encoding electronic data in such a way that it cannot be read without the second party using a matching encryption key. Use of encryption reduces the risk of unintended intervention in a communication. Digital signatures may use the encryption of codes or text or other means to ensure that only the claimed signer of the document could have affixed the symbol. The signature and its characteristics are uniquely linked to the signer. Digital signature routines allow for the creation of the signature and the checking of the signature at a later date for authenticity. Website authenticity routines may use various means including mathematical algorithms to monitor data or a website to ensure that its content has not been altered without authorisation. For example, Webtrust or Verisign certifications may be earned and affixed to a website, indicating an active program of protecting the underlying content of the information. The standard bank confirmation request forms (Bank Confirmation Audit Request (General) and Bank Confirmation Audit Request (Treasury and Other Operations)) include a disclaimer in favour of the bank and its staff. GS GUIDANCE STATEMENT

23 (c) The recipient may not rely upon the information in the bank confirmation. 69 Whether the auditor may rely on the information confirmed and the degree of such reliance depends on the nature and substance of the restrictive language. Where the practical effect of the restrictive language is difficult to ascertain in the particular circumstances, the auditor may consider it appropriate to seek clarification from the bank or seek legal advice. 70 If restrictive language limits the extent to which the auditor can rely on the bank confirmation response as audit evidence, additional or alternative audit procedures may need to be performed. The nature and extent of such procedures depends on factors such as the nature of the item being confirmed, the assertion being tested, the nature and substance of the restrictive language, and relevant information obtained through other audit procedures. If the auditor is unable to obtain sufficient appropriate audit evidence through alternative or additional audit procedures, the auditor is required to consider the implications for the auditor s report in accordance with ASA Co-operation with the Banking Industry 71 To facilitate effective and efficient processes for bank confirmation requests, the ABA, on behalf of banks in Australia, has: (a) (b) (c) (d) requested that the auditor forward the bank confirmation request to the bank at least 15 working days prior to the period end date for which confirmation is required. This will allow sufficient time for the bank to process the request and respond to the auditor within the agreed timeframes; (see paragraph 44 above) undertaken to remind its members of the need for the timely completion of bank confirmation requests in order to facilitate the timely completion of audits; agreed with members preferred turnaround times for responding to audit requests for bank confirmation; (see paragraph 50 above) agreed to publish on its website: 28 See ASA 705 Modifications to the Opinion in the Independent Auditor s Report. GS GUIDANCE STATEMENT

24 (i) (ii) (iii) the addresses of members for the lodgement of bank confirmation requests; (see paragraph 38 above) a list of those members who acknowledge the receipt of audit requests for bank confirmation on request; and (see paragraph 46 above) contact details for its members for the follow up of overdue responses to audit requests for bank confirmation; and (see paragraph 54 above) The auditor should note that banks may have different addresses for lodgement and follow up depending on the customer type. For example, addresses for general requests may be different from addresses for requests regarding treasury and other operations. 72 The ABA has separately issued guidance to banks in Australia regarding audit requests for bank confirmation, including the matters outlined in paragraph 71 above. 73 The ABA has advised that a charge may be made for completing a bank confirmation request form and the auditor is asked to advise the entity of this fact. 74 The ABA has also advised that the record-keeping systems of Australian banks ordinarily do not maintain together information for all entities within a reporting entity, or all accounts of a customer. For example, many Australian entities have current accounts based in other countries. In addition, many banks based in Australia are global and certain transactions and accounts for an entity, such as foreign exchange contracts, may be recorded by the bank in another country. Requests for bank confirmation in such circumstances would be considered non-standard, or complex, and would take longer to process. Conformity with International Pronouncements 75 There is no equivalent International Auditing Practice Statement (IAPS) to this Guidance Statement. GS GUIDANCE STATEMENT

25 Appendix 1 BANK CONFIRMATION AUDIT REQUEST (GENERAL) Instructions Auditor (a) (b) Bank Complete all known details in the shaded areas of this form before forwarding to the bank, including all known account names and the corresponding BSB and account numbers. If the space provided on the form is inadequate, attach a separate request giving full details of the information required. (a) Confirm that the details provided in the shaded areas are correct as at the confirmation date shown below, and highlight any variation/s. Also add any relevant information that may have been omitted by the customer/auditor. (b) Complete the unshaded areas in sections (c) Sign the completed form and return the original direct to the auditor, and a duplicate to the customer, in the stamped addressed envelopes provided. A copy may be retained by the bank. Bank (Name & Address) Customer/Entity (Name & Address) Entity includes companies, companies in a parent-subsidiary relationship, joint ventures, partnerships, trusts, and unincorporated associations. Auditor (Name & Address) Confirmation Date (DD/MM/YYYY) Contact Name: Telephone Number: Fax Number: Address: Authority to Disclose Information attached Third Party Authority attached Yes/No Yes/No/ Not applicable Date of Audit Request (DD/MM/YYYY) Request for Acknowledgement attached Yes/No 1. CREDIT ACCOUNT BALANCES Provide details of all account balances in favour of the bank customer as at the confirmation date, in respect of current accounts, interest bearing deposits, foreign currency accounts, convertible certificates of deposit, money market deposits, cash management trusts and any other credit balances. Provide details for the accounts listed below and for any other accounts not listed. Provide details of any account or balance that is subject to any restriction(s) whatsoever and indicate the nature and extent of the restriction, e.g. garnishee order. Account Name BSB Number Account Number Currency Balance Auditor/customer to complete known details in shaded areas Bank to complete unshaded areas Bank to provide information on other accounts not identified by auditor/customer GS GUIDANCE STATEMENT

26 2. DEBIT ACCOUNT BALANCES Provide details of all account balances owed to the bank by the bank customer as at the confirmation date, in respect of overdraft accounts, bank loans, term loans, credit cards and any other debit balances. Provide details of any account or balance that is subject to any restriction(s) whatsoever and indicate the nature and extent of the restriction, e.g. garnishee order. Account Name BSB Number Account Number Currency Balance Auditor/customer to complete known details in shaded areas Bank to complete unshaded areas Bank to provide information on other accounts not identified by auditor/customer 3. PROMISSORY NOTES/BILLS OF EXCHANGE HELD FOR COLLECTION ON BEHALF OF THE CUSTOMER (Bank to complete) Maker/Acceptor Due Date Balance 4. CUSTOMER S OTHER LIABILITIES TO THE BANK (Bank to complete) Provide details of the following as at the confirmation date: (a) Acceptances, bills discounted with recourse to the customer or any subsidiary or related party of the customer, endorsed drafts/notes, forward exchange contracts, letters of credit, liability in respect of shipping documents where customer s account not yet debited. (b) Bonds, guarantees, indemnities or other undertakings given to the bank by the customer in favour of third parties (including separately any such items in favour of any subsidiary or related party of the customer). Give details of the parties in favour of whom guarantees or undertakings have been given, whether such guarantees or undertakings are written or oral and their nature. (c) Bonds guarantees, indemnities or other undertakings given by you, on your customer s behalf, stating whether there is recourse to your customer and/or any other related entity. (d) Other liabilities give details. Nature of Liability Terms of Liability Currency Name of Beneficiary Balance 5. ITEMS HELD AS SECURITY FOR CUSTOMER S LIABILITIES TO THE BANK (Bank to complete) With respect to items held as security for customer s liabilities to the bank indicate whether the security: (a) relates to particular borrowings or liabilities to the bank and whether it is lodged in the customer s name or by a third party. (If lodged by a third party, that party s authority to disclose details must be attached). (b) is formally charged (provide details of date, ownership and type of charge); (c) supports facilities granted by the bank to the customer or to another party. (d) is limited in amount or to a specific borrowing or, if to your knowledge, there is a prior, equal or subordinate charge; Provide details of any arrangements for set-off of balances or compensating balances e.g., back to back loans. Include details of date, type of document and account covered, any acknowledgement of set-off, whether given by specific letter of set-off or incorporated in some other document; Provide details of any negative pledge arrangements that exist. Provide details here GS GUIDANCE STATEMENT

27 6. LEASES (Bank to complete) Provide details of all known finance leasing commitments Leased Item Restrictions / Special Arrangements Lease Term Currency Implicit Interest Rate Repayment Terms Balance 7. ACCOUNTS OPENED/CLOSED (Bank to complete) List details of any accounts opened or closed during the twelve months prior to confirmation date. Account Name BSB Number Account Number Open or Closed? Date opened/closed 8. UNUSED LIMITS/FACILITIES (Bank to complete) Please confirm details of all available unused limits/facilities at confirmation date. Types of Facility Facility Limit Unused Limit Terms of Facility Use 9. DEFAULTS AND BREACHES (Bank to complete) With reference to the customer s accounts with the bank, provide details of any defaults or breaches during the period and full details of such defaults and breaches. Include details, for example, of: (a) loans payable in default at the confirmation date and whether they have since been re-negotiated, and (b) bank covenants breached during the twelve months up to the confirmation date and whether the breach was remedied. Provide details here 10. OTHER INFORMATION Please confirm (see shaded area below) and/or provide any other details (unshaded area below) relating to any financial relationships not dealt with under sections to 1-9 above. Auditor/customer to complete known details in shaded area Bank to provide other information not identified by customer GS GUIDANCE STATEMENT

28 11. BANK AUTHORISATION (Bank to complete) This certificate has been completed from our records at..(bank details). The Bank and its staff are unable to warrant the correctness of that information and accordingly hereby disclaim all liability in respect of the same. The information contained herein is confidential and provided for private use in confirmation of our customer accounts for audit purposes only. It may not be used for any other purpose or by any other persons. In particular this is not a credit reference. AUTHORISED BY: Other authorisation details (where applicable) Signature: Name (print name) Title Telephone Number Address Date Completed GS GUIDANCE STATEMENT

29 Appendix 2 Instructions Auditor (a) (b) Bank BANK CONFIRMATION AUDIT REQUEST (TREASURY AND OTHER OPERATIONS) Complete all known details in the shaded areas of this form before forwarding to the bank, including all known account names and the corresponding account numbers. If the space provided on the form is inadequate, attach a separate request giving the full details of the information required. (a) Confirm that the details provided in the shaded areas are correct as at the confirmation date shown below, and highlight any variation/s. Also add any relevant information that may have been omitted by the customer/auditor. (b) Complete the unshaded areas in sections 1-9. (d) Sign the completed form and return the original direct to the auditor, and a duplicate to the customer, in the stamped addressed envelopes provided. A copy may be retained by the bank. Bank (Name & Address) Customer/Entity (Name & Address) Entity includes companies, companies in a parent-subsidiary relationship, joint ventures, partnerships, trusts, and unincorporated associations. Auditor (Name & Address) Confirmation Date (DD/MM/YYYY) Contact Name: Telephone Number: Fax Number: Address: Authority to Disclose Information attached Third Party Authority attached Yes/No Yes/No/ Not applicable Date of Audit Request (DD/MM/YYYY) Request for Acknowledgement attached Yes/No 1. BALANCES OF ACCOUNTS (DEPOSIT& ADVANCES), SECURITIES HELD (a) Please confirm details of all account balances as at the confirmation date. (b) Include details of: nostro accounts, vostro accounts, current accounts, interest bearing deposits, foreign currency accounts, convertible certificates of deposit, money market deposits, etc. Confirm details of any securities held for payment, e.g., Promissory Notes. (c) Confirm details of direct liabilities (bank & term loans etc), indicating the collateral lodged by the customer in respect to each outstanding loan. Details of repayment terms should also be confirmed. Account Account Name Number Auditor/customer to complete Balance DR/CR Currency Interest Rate Bank to complete unshaded areas Interest Accrued Date Paid Other Charges Maturity Date Collateral Lodged Bank to provide information on other accounts not identified by auditor/customer GS GUIDANCE STATEMENT